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BAC KGROl'TSD or THE INVENTION 

A . tela of the 1 n .ven tion 

I lib invention icLtes to the fbld oi computer networks In particular, 

the A meivn>n relates to acvtunimL ,.nd bj!bn.j h i services in a computer 
5 network... 

B T> srrptton orthc Related Art 

1 he iovs cost of Internet eonnectmtv and a wide jange of hen. tees are 

driving and more people onto the Internet which is driving the deployment of 

TCP'1P ncwork. This, process has led to a he* market ot clicnt-scrvei 
10 appheitions that eiabicb the it >ei to interact v\ ith other tr;ers and computes 

s> item*, aiuLnd the world 1 he u« of these applications is cv lsummg moi - and 

nunc InTanet and internet haruhsidth 

New applications auch a>> "voice er IP drteina Protocol) 1 ano 

streamy audio and \ dco icquirc even mose bandwidth mci a difterem quahtv 
15 Cf service than email or othei te<o teal-time applications Also the type qualm 

of service can vir> ac cord.ng to the nec±! at the u*ej Foi sample, typKall> 

businesses do not tolerate unavailable network se-\iecs a,s easih as consumers 

Internet Sen ice I'rowders theietore won d ake to price then available 

bandwidta accoia-nj? to a usei's needs For example, f at monthh pricing ma> 
20 he the best billing model toi consume <\ h it businesses may *ant to be billed 

according to then i sei b.t.tawieth at particular qualities of st.-i vice 

2 
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■\s ISPs continue to differentiate themselves by providing additional 
services, enterprise information technology managers will race similar problems 
fo account far the escalating intranet operating costs. 

Therefore. ISPs and enterprise information technok<g\ managers; will 
5 want to account for session logging, bandwidth usage, director.' data and 

application session information from a variety of sources. 

Due to the diversity of IP data sources (e.g., routers, bibs etc.), the need 
for effect tracking far exceeds the problems addressed by telephone companies. 
Telephone companies track information such as circuit usage so it can be 
10 correlated with account information. For example, businesses may use leased 

lines, consumer*, may have ''Friends and Family"' plans, cellular phones have 
different reamer tees according to the location of the user. etc. Typically, the 
phone company captures ail of the data and uses batch processing to aggregate 
me information into specific user accounts. For example, all the long distance 
1 5 calls made during a billing period are typically correlated with The Friends and 
Family list for each phone account at the end of a billing period for that account. 
This requires a significant amount of computing power. However, this type of 
problem is significantly simpler than attempting to track and bill for every 
transaction in an IP network. Therefore, what is desired is a system that allows 
20 for accounting and billing of transactions on IP based networks. 

The problem is even more difficult in IP network traffic because the 
information sources can exist and many different levels of the OSS network 
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model, throughout heterogeneous networks. Potential sources of information 
include packet use from routers, firewall authentication logging, email data, ISP 
session logging, and application layer use information. Therefore, what is 
desired is a system and method that track IP network usage information across 
5 multiple layers of the OS1 network model , 
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SUMMARY OF THE INN KNTION 

\ netw irV accounting and billing system ard method are described In 
some unhxtmitmt'S, me s\ v.eai cats ai.ee ;s anv network related information 
sources such as traffic; statistics provided 1v routers and switching hubs as well 
5 as application server access iotts. The information can be accumulated m a 

central database tor ct eating ^uditmg. accounting and billing reports 
Akenvn-vciv, the information can be sent directh to other system*, such as 
rating engines ased in customer caio and billing systems 

'n one embodiment. T, > t\v< ik tt attic information is oapmrac at network 

10 information oourecs ^example* ot information sources, include now oik devices) 

These source* provide derailec mformamm about the. nctwoik con-tmiimcttions 
tiansa-tions a\ a netwoik device Importantly, different tyncs o f sources can 
pros ide different types of information Gatherer devices gather trie detailed 
information ticm the \anous information source device* and annett the 

1 5 ii f< <rn) -it h m mio standardized mtormaliun I lis, tathcroi dev.ces can correlate 

the gaticrcd nrormaticn with account information for network transaction 
accounting. Manager d?\ices manage the gatheier devices and store the 
garnered standard! >ec information The manager devices eliminate dupl.cate 
network information thai :na> exist in the standardized infcrmanm The 

20 manager dev.ces also consolidate the information tmpouamh tJie 1 1 formal ton 

stored ?\ the manage! deuces represents tnt consolidated, account conelated. 
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network transaction information used for billing. In addition to account 
information. tiansaUion intimation can he correlated n< othci inionrauun such 
as jBOgraph} udormation fe c , the location tit an « ccsscd scncr) end/or 
ttdnsactK-n ioutm« -nkinnauoa <a L mav be us.d m peering agreement benu-cn 
5 internet Spruce Pun deft,) The system tnercb} pm\ides a oibL.buted network 

accouvin^ a id biLfng systeir 

In somt embodiments, the ga*e cr device* can a^' souice* tli ough 
nroys ^atcwa) s firev,alU and uj address transmit on bamus. 

Tn some embodiments, the j-tJheiei devices can ^-rrciate the ailo.nmtKm 
! 0 about a -Recife nu-ibot lion ^ 'ih " particular *.co or t b> accessing the 
transaction b ^om^ ~nd .» destination mi" mation The source and oj 
Jesuint.on mformatirn is trien ecu elated with acomnt m<onrktu.>n + rom a>. 
account information database. 
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HR1I I DLSCWPriON OF THF FIGX RES 

r t fi^ursi- iilus iate tht uiueinion t > ^av oi example T tc ]i\enti m i> 
n< i rreatii to bo !imi ^d o ouK Uiosc bodimenf oi shown m tnc i guc I he 
same ick rt >.t 'i ditieient f isjii'Cs mdti,aa.- tn*. -lame element is being u^ed in 
5 those figures. 

Hguu illustraiv i a ^Tt mJudiru? one enKxnire n of the imemion. 

IVjie 2 il'.u^trdtC's. ai example oi tht tL still n>o» n-,ed ir mt s\ ,tem 
of Figure i. 

f^r- > i jsei at > d ita enhance u^rus u,cd m trc iiu dio* Ikvticn 
iO -leiru + -\ iiu-tratts tvrrrpit field enpan«.emenis 1 it 1 v,an be mdudtd m 

the data enhancements. 

Figure 4B illustrates the creation, of an enhanced record. 

Figure 5 illustrates an example record merge. 

Figure 6 illustrates an example of an alternative embodiment of the 
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DETAILED DESCRIPTION 

A, System Overview 

One embodiment of the system includes a imilti -source, multi-layer 
network usage metering and mediation solution that gives Network Service 
5 Providers (NSPs), including Internet Service Providers (ISPs) and enterprise 

rtefwork(irsiranet) operators, the mformation needed to set the right-price for IP 
(internet Protocol) services. With the system, the providers can generate 
accurate usage-based billing and implement usage-based charge-back models. 
The system derives IP session and transaction information, collected in real 
10 time, from a multitude of network elements. The system gathers, correlates, and 
transforms data from routers, switches, firewalls, authentication servers, LDAP, 
Web hosts, DNS, and other devices to create comprehensive usage and billing 
records. 

The system transforms raw transaction data from network devices into 
1 5 useful billing records though policy-based filtering, aggregation, and merging. 
The result is a set ot detail records (DRs). In some embodiments, the detail 
records are XaCCT Detail Records (XDRs™) available from XaCCT 
Technologies. DRs are somewhat similar in concept to the telephony industry's 
Call Detail Records (CDRs), Thus, DRs can be easily integrated with existing 
20 Customer Care and Billing (CCD) systems. 
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In addition to billing data, DRs enable NSPs to deploy new services 
r-ased on ciocamemeo usaje trends pi in >u.,n< ik £e^m<.c piousionmg md 
audit Kf i va^e The swem p!** ioe* a clear piaua. of u<-ci~se\<J network 
s<?p' ». ist- bs T .ckm« a \anels ot rictnt-. sucti a i actual i>e<- m m Qualm ot 
5 So \ )a {.Qobl^rdH c ;out:s nd cnd-u .er app ?ca\on transact, ors 

I o s\ >tcm is .->aseu on a ntoduktr dmnhired ngrh <-e.iiabk 
arc.huectjre capable running on multiple p at*.ums D it i rollectton i iO 
ruiu^GTSLnt iv -UMimed ior ei fiuene} to n mmu impact on the netwoik and 
system resources. 

i 0 The system minimizes network impact by collecting and processing data 

ciose to its source. Modular architecture provides maximum configuration 
flexibility, and compatibility with multiple network information sources. 
The system , or other embodiments, may have one or more of the 
following features, 

1 5 D ata collection can be from a wide range of network devices and 

services, spanning all layers of the network - from the physical layer to the 
application layer. 

Real-, line, policy-based tittering, aj^regatien, tnh?n L emcnt and 
meigmy ireaus accurate, detailed and comprehensnc session detail records 

20 (DRs). 

Real time con-elation of data from various sources allows bill ing record 
enhancement. 

9 
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Leverages existing investment through integration with any customer 
care & billing solution, reducing costs, minimizing risks and shortened time-to- 
market. 

Non-intrusive operation eliminates any disruption of network elements 
5 or services. 

Web-based user interface allow off-the-shelf browsers to access the 
system,, on-demand, locally or remotely. 

Carrier-class scalability allows expansion to fit an NSPs needs without 
costly reconfiguration. 
{0 ") fatn touted ink" in ^ and acue^ati n vJiranates \sum t uixk 

rjotilenecKS. 

Iftkient lAuxd s ; -u,n aom s.tsuvHu n allows »j-i^e-fh " ,tem 
>e(.n, ff-unti i. s an^ Aeld upgrades 

rvtomuui sporting <\nh buiK-m lepori gcntution O' m NSPs dioiu 
15 ot o t t!t x .tied ^rapricai rt porting packaa^s 

ompiehensrve rtwo^ -.euituy ka.ures -.Iiovn acun. unraii' n ljUoii 
hetHtor 'Vtefn.ompvneiusanJ nuimie la^NoM^nkUdauc^ 

B. System Details 

The following describes the system 100 of Figure 1. The system 100 
20 allows NSPs So account for and bill for IP neiwock communications. The 

following paragraphs first list the elements of Figure 1, then describes those 
elements and then describes how -he elements work together, importantly, the 
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distributed data gathering, filtering and enhancements performed in the system 
100 enables load distribution. Granular data can reside in the peripheries of the 
system 100. close to the information sources. This helps avoids reduce 
congestion in network bottlenecks but still allows the data to be accessible from 
5 fi central location. To. previous systems, all the network information flows to one 

location, making it very difficult to keep up with the massive record flows from 
the network devices and. requiring huge databases. 

The following lists the elements; of Figure 1. Figure 1 includes a number 
of information source modules t'TSMs) including an ISM 1 10. an ISM 120, an 

1 0 ISM 1 30, an ISM 1 36, an ISM 1 40. and an ISM 1 50. The sysrem also includes a 

number of network devices, such as a proxy server 101. a DNS 102, a firewall 
103, an LDAP 106, a CISCO NetFiow 104, and a RADIUS 105. The system 
also includes a number of gatherers, such as a gatherer 161, a gatherer 162, a 
gatherer 163, a gatherer 164, and a gatherer 165 The system of Figure 1 also 

! 5 mel udes a central event manager ( C CM i 1 70 and a central database (repository) 

1 75. The system also includes a user interface server 1 $5 and a number 
terminals or clients ISO. 

This patagraph describes how the elements- of F^ure 1 are coupled The 
various ! etwir-c de\ ices represent <.k\ ices coupled to an IP netwoik sach as the 

20 Internet The uet\\o:\ devices perform various functions, such as the prox\ 

serves 1 01 providing proxy scrv ; cc tor a number of client* f ncn network device 
is counted to acouespond ng ISM. bor example, the pr ^v, sener 101 is 

11 
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coupled to the ISM ! 10. The DNS 102 is coupled to the ISM 120. The firewall 
I IP . , l< i« r Ld to tht N \ i 1 I »w S\i i<- c mPfc i t > ; D VP J lu 
ls\f 14 t iup ed to t ( c <. fSC O Ncrtdo* 104 J e IsYl I *C is> u uolod to tin 
RADII'S K"" 1 1 u„h ^anvicr is a^ocated wuhaticactont l^M Ihu 1 the 
5 £\rh.uu ■>! ^ assoif. ted vu'h the ISM I'» ami i > th< reioi<. ^ouplu. to lb it 

ISM Tiv. ^tht'ci 1*0 ^ t-nu|»I<M tt> tie *SM ' ">•» lbs gathers , .oip'ed 
ti iIk ] wid hi ISM I *<> Tn. gadieru h<4 ts wouplod to the ISM 340 
1 no gatiieru lo^ j> t mrjLd i< th^ isM I s ) The \anon gatherers are coupled 
t the LLM P f TK u^u jrk s if<ri.e seuer cupied *o the ttnnmai" 180 -5 \v 
10 theCEM 170. 

Uciul ounifj puair^chsdes. nK im <> i^c ^ moti t c no it* ot 
Figure 1. 

Network Devices 

The ntuvork de< u w "^estnt nay dc\ tt-es- that could Se liK'ikk J m a 
15 re-woik i Jiioughout the Jescrpt'on a netvsotk dc\ ite tinier specificaih 

aotv.a i thc-mut, a,s<> retcrs to an application vsr ei s \ network de\ie^ 
repreocnts a ouhsa < ! ritorma ion ^otircws that o?n ho Used b\ tht s^t-n 100 
I act ic, the net<A nL ds.\ itcs are mereh ^prtsenialrve ot the tvpes oi sol n es o! 
rdonna.'v voald It a^e^ed ( Hhei de\ice^ ^ieh as on-hne ttans ic uon 
20 pfutx^ni- Jut b''ac caalc ^cre^ed tn oner embod mcnuNot the ir.va,iK>a 
HpjuU \, the network acuces keep logging and ^laM^ic^ niorma'aon about 
t le^i aui\ »t\ \ i.wiwork i iturinatioh soarcc can r%* the log tile o» a iva.i senet 
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the logfiitui l t-fl o afneA\ t i] a ratias ^lati^t ^ lane i\a labu* ok a r ni 1 c T 
.ml in.t-.vibk through SNMP a ditab^e uirv .xt-e^sthc tb r ou:-h tnc Interna 
m aathentiut ( >n sen _r s jutrs interlace «rtc Thf network ac* ic<_s repie-^et t 
♦be into nation ,<>uru^ mLfAed h\ the JSMs 

La«.h upe ot notour! ac\iec can be acsesinm using i ^liferent methoa 
or proi K"ls b nnc t,etu.ra'e i >g-> v title 01} us tit <k es <* 1 . < S\MP, i tl crs 
Ya\ t pn >[ ! ietan ^Plso r i<ie other proVicols 

ISMs 

The ISMs act as an interface between ilte gatherers aad the network 
devices enabling the gatherers to collect data from the network devices. Thus, 
the ISMs represent modular, abstract interlaces thai are designed to be platform- 
neutral. The information source modules act a.s interfaces or ''translators'", 
sending IP usage data, in real time, from the network devices to die gatherers. 
Each ISM is designed for a specific type of network, data source. (\n other 
embodiments, some ISM are generic in that they can extract information from 
multiple network devices). ISMs can be packaged separately, allowing NSPs to 
customize ISM configurations to meet the specific requirements of their 
network. For example, in the system of Figure 1 , if the NSP did not have Cisco 
NelFlow devices, then the ISM 140 would not have to be included. 

The ISMs can communicate with, its corresponding network device using 
protocols and formats such as UDP/IP, TCP/IP. SNMP, telnet, flic access, 
ODBC, native API, and others. 

13 
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In some embodiments, the reliability of system 100 is enhanced through 
on-me !h c\nanrc i^l on figuration, allow trig the VSP to add orr<.m<>\c 
moduxos without iwupting oi.gom^ opetdtio.ii. In *hesc embodiments,, the 
'"FM P') i_an dutorrauuilh upJa'e lite fSMs 
5 I he to lowng h>Ms .ire a\<idabk in O nrno em lotl'moou of the 

■invention. 

• < itegtmrf - Ch^sjfie-. a session to a category aec^.dmg m user- 
defined Boolean exp-e^sion 

• 1 >\'*s U ^ ISM 120} Ketones ho-,t rames and IP addresses 

] 0 • titneric P-oxv <ei\er fee. ISM 1 10) - 0 >llec^ oara fiem awt^t. 

togs in a common log tormai. 

• Port - Pi oil >.ol Resolution - Converts protocol/pott mioimation to 
account names and vice versa, 

• Utc.kl'omt 1 ir^all-l - Collects data fn rr Fiie'Wa'l'l aeuountmsi 
1 5 log and security log. 

• C ts».o \0> IP A-voenting - C olicct , acciunti ig data irom i Cisco 
router using IOS IP accounting. 

• Cisco NetFlow Switching - Collects session data from a Cisco router 
via NetFlow switching, 

20 ♦ NETRANET - Collects information from a standard network device. 

» Netscape Proxy Server - Collects data from a Netscape Proxy Server. 
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» Microsoft Proxy Server - Collects data from a Microsoft Proxy 
Server. 

ISMs cai; be synchronous, asynchronous or pipe. 
The data from an asynchronous ISM is dynamic so that the 
5 asynchronous ISM reacts to the information and relays it to the associated 

gatherer withour prompting from other information sources in the system 100 
If the firewall 103 were a Checkpoint Fire Wail- 1 . then the ISM 130 would be 
an example of an asynchronous ISM. When a network session is initiated, the 
details arc recorded by the Fire Wall- 1 103. The corresponding ISM 130 receives 
1 0 the details and passes them on automatically to the gatherer 1 63. 

Synchronous ISMs provide its information only when accessed by a 
gatherer. The ISM 120 is an example of a synchronous ISM. The DNS server 
102 maintains information matching the IP addresses of host computers to their 
domain addresses. The ISM 120 accesses the DNS server 102 only when the 
1 5 iSM 1 20 receives a request from the gather 1 62. When the DNS server 1 02 

returns a reply, the ISM 120 relays the reply information to the gatherer 162. 

Pipe ISMs operate on record flows (batches of records received from 
information sources). Pipe ISMs process one or more enhancement flows the 
records as the Hows arrive. The pipe ISM may initiate new record flows or may 
20 do other tilings such as generate alerts or provision network elements to provide 
or stop services. The pipe is implemented as an ISM to keep the internal 
coherency and "logic of the architecture. (Record flows can terminate in a 

15 
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database or in a pipe ISM. The pipe ISM can perform filtering and aggregation. 
-ene 1 at airs o? <>c* as ^ median, >r s\stem t<- pio\.siot nuwork elements nhcn 
oome u\vnl < Cvias « srmc ptcumuhletl ^alus, i* .-.urpa^d Speeiliealh, pipe 
,SM- van <ict to enahie nre-pavn cut iy< terns t - viable certair arvices suib as a 

5 \ oiee IF t.al!, \vhe i me t imt lim; is surpassed cr amount < if J'iu is jet chad ! 

Hie Daiherei? can meiu<Je cacHts. /tat. fritt-is. l > stoma mfomation 
truni the ISM- I K* hufftis ailcw thi ^athcteis v o compensate tor Situations 
wK-to -hue is jl ,o5s of ^on iccjoti wuh the rest of the a stem 100 fne c.ehe 
si; es ^an be temoieij contoured The ea*.he -nrvriti^;. the nam bar ot accesses 

10 to the mtormation Source. 

.SM queue 1 , van i l ~athei i td pataHc\i7_\_ Caeh ne ui svndirntious 
ISM u aaies. pr.tvii.ie-> 'br tast t espouses Pauilei /m« qu,.rse< aii< v.s tot 
mulrpk putties tu b^ proei.s-~d at the &an^ tune 



embodiments, the gatherers are muiti-threaded, lightweight, smart agents that 
run on non-dedicated hosts, as a normal user application on Windows NT or 
Unix, as a background process, or daemon. What is important though is that the 
gatherers can be any hardware and/or software that perform the functions of a 



Gatherers 



15 



The gatherers gather the information from the TSMs. In some 



20 



gatherer. 
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The gatherers can be installed on the same network segment as the 
netv.0- < dt" ice so.cn as muter mi J ^vi^b i j <. n die ipp' cation ier\er itself Th s 
[>if cement o "a gat vru m murines the data traila. impact on *he notwoik 
I he j itheu-rs collect network session data *toni one 01 mote ISM- 
5 bCision data c u be sent to anoJter gatherer .or enhancement or to the t. EM 1 "0 

lor inert: nw; and storing m the central iaubase 1 7 0 The gathejer* can be 
depiaved on ait as reeded basis for optima sea, imht\ a-.d tb-obilrft 
The gatheters perform flexible pobo-baaeo data aggregation 
bnportanth th^ various types ot IbMs pro\ idc different data ani m dtftuenl 
10 format-, Fie ^atncr.it romuiize trie, oata bi extracting tre fields -seeded b\ me 

f F\t n and filling n vim li.kh tn.tT ma\ be iTVi'-smg lira--, ttu gatherers -u\ 
a eiati bued filteung and ag negation ostein fhe dMnbnted data ~ihenng 
and aggregation e'lmmatei vapaufv bottlenecks' m proving inc scaiabiht> and 
t-f.t" aorc\ < " the sjstr-m 1 00 b\ i educing the \oiume ot data ocm on tne network 
IS loiheCEM 170. 

\ggregatson can he ootic b 1 ficcunndaU'>g gi ^up? ot data iceoio. flows, 
iiereratit.g a single dJ:a record tor e?ch gioup ihai v *%>\r r^un 1 tVn include, 
ihe aggregated mfwmaLon This i educes the How oi the data ieco:ds 

Fdttnm' means discard ng any if*u>rd that belongs to a group of 
20 unneeded data records Data iceoici, uic unnejUed .f i"~ev ate .aiown to be 

colieete iehewhej c A ->c>\x\ hamewoik enables the NSP to c< nf gure what to 
collect where. 
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Filtering and/or aggregation can be done at any point along a data 
e-mia-cenieru <ae->.iibsd K*k n » o t] at ggret-'ation m h<\'VH> tar he b »>td >»n 
cnhar . c i Liu *ecoics a-> thtv in* aca.mu'ated The JHcnng anu or aggregate n 
points mc trv<± v. J ns tf c wstun 1 00 as ^pt i^NK whseii lie f o\v T ennt nation 
5 and fl< n skrtng potrt f jo liVe an av>n< bro^ous f'-At on tne startsrg end <aid 

hkc a database on the krm nanus, viia) Data taiiaru anient pa-hs md f 'hiring 
and < .agregatirn schemes can be based on av.ti.mu.kte,. peramtter^ such at 
use ideaafka ion nioimanon anc a usu eontiaci t>pc 

\s n ueJ -tbos c, the PISM cm jc mzti w the context oJ iihenng and or 

1 0 i^cA-- 1 or> One or a*ore reeord fos\^ can terminal at the PISM ana can be 

topve^-ted irto one oi more new record f <>v,s Record lions are grouped based 
on riatJurv n lc> that apph U some of die fields m tti- record Cows, <\hde 
others t r e „<. t. urmda id or mdeioo seme otiiet i >ivr.m m such as maximum' or 
' <s\ t igi Ontc the gi ou i« oi acc amulatect records ha\ v, r eathed >.omi 

15 thicsbo d new 'cuitilL ted rc».t td> mo output ■ is c-n u-ed t.n i\am ->Ie iu 

o der to erie 1 e a busmtss-hsb id fiavnng anu atvrc^at ot Uau rediiv, ion n> 
impo-iHL* fie dus ne--s iules <>r tbe usag'* b i ed pr ^dacts h..j an, otfe ed to the 
tuslemc cntn the nxu d flow- as thjj are niltc. tec m ievt!-tia>e Thi •. ts t one 
instead oi pu vious s stem v. here the m !< n ra^ tion s stored r> a dt tab^tst and 

20 then database opeiation^ aie pi i iormed m n'dcr to create hll •, or report 1 he 

tireiing and aggregaao i re^uevs the anuiutt <>i d tta J at 's ^tmed in die v.e«:ia 
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database 175 while not jeopardizing the granularity of data that is necessary Sa 
otdu lo acne crearivt usa^e-haiCt piocucts 

f \ pitd.lv data ^ohect*.d tn. m a single ">uie«j dots not cuinm all the 
jTiiPrmdtion reedt,! :ot hdling ana actoiiminfc such as iisct name and 
5 organi 'iron 1 1 si ch >.ases i ic data is toaanCvd Bv tivnbmin^ IP sexton data 

hom mull pn- Sanctis sui ti a^ rfLtitit'i. itaiion -cnu' DHCP mo Do n up Name 
seno's th. j-am^iei s citato meanmwful Mission icturels tailr *-ed to th^ \^P\ 
speuhc -eqiuemcnts in the example ot I fgaie i tint ga'hercr ol t .n \ de 
sni<r*n Hum t" the catheter ItC *> that the ^ouice IP addrt^s *i>r an li temet 
10 >ttjoair^n the prov server wnb. ahfbn.ou o ih ih^ i >oain idd-vi- 

fiem ire Ob S sen y 1<C 

1 he c i it eerne.r j rvxduit c^ti he rngt'ejed 'tv an as\n*.htonou\ I^M 
I tc 'nkrrnat oi iromthe a vnchronotis i^M js ^p-jouated win tldd 
enhanten cms m the centra, cataia^e 75 ,\ field ertiwkemem defim-M how a 
15 field 'ii ht ^uitial Jatahate is filled fiom tnt aoui.c data oKaireJ iroirt the 

3S\fithionoi!s I^V 1 joyoii trie Uci J euhanwinenU. the missing parameters are 
idiVd *u t xtuou' us ng t f d t <i tol ec.e t tn m hit oi iro e wpchohdu 'sV 
Lnrcncement- aic described tn detail belo\s 

The ga.hcre-s can include caches ?n<£ in ttus f*r storing s ltoimatior 
20 tnim 1 TSM 1 \e DUire s adow *r>e ^therers to tomncn^ate Tot siti ar^ns 

vvnerc there f a loss of connects n -w ith tne rest of t it s\ mc'I i 1 he v. acne , 
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can reduce the number of accesses to an information source. The buffer and/or 
cache sizes can be remotely configured. 



The Central Event Manager (CEM) 1 70 acts as the central nervous 
system of the system 100. providing centralized, efficient management and 
controls of the gatherers and the ISMs. 

The CEM 1 70 cm perform one or more of the following tasks: 
• Coordinates, controls, and manages the data collection process. The 
CEM 1 70 coordinates the operation of the gatherers and manages the 
flow of data through the system 100 through the collection scheme 
defined in the system configuration. The latter includes the 
configuration of the gatherers, the ISMs, the network devices, the 
fields in the central database 175 (described below), and the 
enhancement procedures. Based on the collection scheme the CEM 
170 determines the system 100's computation flow ithe set of 
operations the system iOO rnus; perform to obtain, the desired 
information). The CEM 1 70 then controls all the gatherers, 
instructing then- to perform, in a particular .sequence, the operations 
defined in the computation flow. The CEM 170 receives the records 
collected by the gatherers and stores them in the central database 
175. NSPs can configure the CEM 170 to merge duplicate records 
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before storing them in the central database 175. Record merging is 

described oebw. 

P^rt mis Jt n-np i.td igtn„ prOvCduti,s in il^c daf iha ^ iht, 
>i,inj ion u lLa-> and stci , atae . mounts or scssKn miorrn^non 

d„i Uir <. FNf! "(J r<.m<i\e oUdatafc tut, p^e tome* data 
pcrio-Kalh 1 1R- KSP ^ t tires 'IK e\piratiui pe~.od i > fn. wti(^ ai 
Co d rwcrds I he LFM 1" i responsible lot toofdanti^g rht 
luminal uf records tip.n the ceit.ai database 1"^ Ihv ( L M 1 70 
pt u,v^ 3 1 nil. <■ amp on ev en record si ci the le^oid entei s the 
v.^t! iJu^i " and <JJu-< *tic KC L.-tte u< time pas >J tk. 
j\SP h. dUinco ehpse-, 

}*■ i\ d.<? t cn^raii'eu system vtj<jf i; gride h enstn ' ltd iata 
'.^unu T>ie VC= P c i i pesmm vtiMon ipi/redc-> ol in^. s\ tiem t'H) 
a u< C'-M P 7 he Aaberers < uuv i-tomane?! , upgnded >iu,e t 
irw \u-ion & mVaiLd on ur host c >icpjtwt if tie CTM P ) ISVK 
re « so installed \ia tht ( I \P " ' md expoiu^ u> tl e «at cru 1 he 
t_fcM i" ( nairiM n<- a li t >f Kcn-^ ailed iiu. ^st-m^ni 
^nfiesp nod <_alh i^fbe ■•wem \p>ope»K licensed This f^atot. 
las uie J cuvni i m.ti 1 and n n^ll hcen-.es t also prx\uus 
^nUui^d u>t oi 'he saici IPC and a) \ <J t tonroient 
M nti" the s au oi the gad eie-s and IS N K ihe bathes er- 
'vr xhea \ c "imtnuricite with me CLM l^C 7 he I FM 1 70 
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continuously monitors the state of each gatherer and network devices 
in the system 100. The CEM 170 can be fault-tolerant that is, it can 
recover from any system crash. It coordinates the recovery of the 
system 100 to its previous state. 
5 In some embodiments, a key directory server is associated with the CEM. 

1 70. To transfer less data between the elements of the system 100. it is desirable 
that each piece of data to carry little descriptive data. For example, if IP address 
data is transferred between a gatherer and the CEM 170, a description of the IP 
address data is typically included. In some embodiments, data name/key, type, 
10 and length descriptions are included with the actual IP address data, in other 
embodiments, there the key directory server reduces the amount of descriptive 
information being seat Every key in the directory server has a type and a 
length. Fields can be identified as variable length. Therefore, data type 
information need not be transmitted between elements in the system 100 if (he 
1 5 elements use a common reference key stored in the directory server. Returning 
w the IP address, data, by using the key directory server, elements need only 
send two bytes for the key id and four bytes for the actual address. Most of the 
data being sent in the system is relatively short in length. Therefore, the 
directory server helps reduce the amount of information being sent between the 
20 elements in the system 1 00. 

Klevs can be added to the directory server. The directory server can 
therefore support expansion of the kinds of fields being sent by allowing system 
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elements to update their iocaily stored key ids. For example, after a recipient 
receives a record with an L ' unknown" key. it contacts the directory server to gei 
the key definition. 

Central Database 

5 Tie central jaichasi. is the optional ^nnai ten<isjtois of the 

•nttrma ion tuliuttu hv be v stem 100 1 he tertr-l Jdtubasc out one 

exanu le ot a sir 1 k>i the data generated in the s><tcm '00 Other e.mbod.roents 
aiduui, >the e'triigiratuni Lie cenfal databa _ 1 ~ s s.oret and maintain- th<* 
jfta loI octed r>\ the ^ativier 4 a* well as we irtoTUtion < u the- ^ontiguranon 

it) jf the ■we \ I CO 1 rut in vo-iigtbin^ t ie s\ rem R 0 tie \ sP di- tries ^ria< 

<Lta witl i l b^ued {ncMLh lh-kl in <hj ^.emt i d^lar »se aid h<>\\ tn,,t da + ? in 
cohectea trom the Ii>Ms. 

be mioirtiation on nc\wc sessions is stored in ihz ,latair>Ke in the 
%moiataHe EaJ fijj in tae tabic iepicrent<^ neM'ort session parametu 

15 ^xt ra< ra je>cime . tetvwtt stssioa The system 100 ! 3s t s,** ot pie- 

dtttnjd ilcl i ^aaa on! un^d b, the < FM 170 on n taJ ahoi r\:\-rii 
mode's iheunti Ida art .sw 1 stiuLjt.c h\ addtns dekun & oi modd\trg 
iitlds 1 hers SI access the dau m the centra! oatabaoc P5bs i armtrg qiknts 
and report T he old dara js iciro^ cd rrom the ctniral database 1 7." to tiet, spave 

20 ja n.v, <.ata penodica! \ \ou ...n speerb tl . tmc interval i<> <\ht«.h ie<.<>3d<- 

are >toiev< u tht <. LPt aU'alab isc t?^ Ihv. ^uiuure ui thv. tf nrj \\nb\ c '7^ 
w th son*- ot tbe j^edefmed oelds is d!u<-tracd in de fodowmj neu c 
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V civ h H* ^sm n n a, lunerat. muittric t' ms^ctson jecoid* dt, tug ttic 
nitrce p^< ccs iic C T \t O) identifies ina iisct rJ> duphca 'miu etaiat cnu; the 
eifiaerc < i the L.a a rcposm >r < ictiuali % data teeo'ds ..re passed tf no igh rht 
ncgc- nopi un su'het EM 170 mV T u central database 1 " c how cur the 
5 J< la ,u, ics art also cacticc -o tha* it mitchtru w ords appear it <,owe point 

lie iiri^b stored iiX'-ids can nc icplaud or enh need ^vi h he n *w re^nr js, 
iho dt.«ibd-A. tablt^ that contain the reccid fkrns can be indeed, entiancmg the 
efftaerc. >>f thw data rtpe itoi\ A nwrut. j» . i hi^u d >i\ iruvfwrg some ot the 
it ds a d u rrt or 1 md 'her mergm c ih? ma e m g refolds from at lev-* two 
! 0 Ovoid p - iran-.ii> rrung their into . nc ctoid ivfo r e upual ie t ic eenral 

latabas v 17 c 1 1 oiik cinbudimcnts adaptive tolerance i_ ~. c ed o i latch 
records ulantrve VleratK e a io^ = toi a \ an at ot m tie \ alue- ot fields t ut aic 
c mpar_d je g , tic rs ne held %alue nun br •Jiuvv-d o hi Hi ^ om* amo ml 
but st 11 be cohSideud a n ak\iI Thr ad-*n + i\e a->nee* of the matching cai 
15 .tuiuie t miing *hc ^pj-M'iria'e penod to iilow tor ti. tokuncv 1 Vu. reason 

That the ccoid Jiat do not nvtel an* arts <ov teeords ,ae sent thiols i into tie 
central e^abase 175 ta addiU >n ro bun cichcd tor lat;r natchfm? ,s to mud 
loss ot o~t i in case o* ssstem failute 

The following latL tikist- ite-, an evani ">ie ot ti e is ne> oi records store i 
20 in tin. e mril aa*at-*tt ' h\ the CTM I"M 
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! , 1 i 

Thv swtm ! »U ^ ppo> s a not propria^", ijutaba-*. km v «ub' i ^ tlu 
(.enti -ii uitabi->t ^ n oi) on »■« a. inon'bt-rt i c innn-rudlU n t Ubh 
uiati iu N'SSgLVrvLi OtkicSe.-su PB" 1 etc > 

T ci h t^rfat-t. S^rvc ..ni Chuib 

Ihc Usei lnt.*rin.t Server t tUM .Ho^s m< lipu icnts ic g 
knit 80 in v * e t swt m )0ti» it i t> t Mtuo oft In.' erne t 
i >plo t v tth 1 1 Pit o ii oi \ i r->i,3p K .\i t>l 'to r \"»3i{ !«\ > 4 Pi ig m < >thcr 
vinttod m^rst-, «miu thv.r applKatirn to icu',n tiie \<terr 1' T Tre mam 
lunUi jrn U 1 1 IS 185 is t froNide leroott. ind local pi >tk>n>j < ldopviiaent 
ntrol t~>r ii2 stem i00 Hit IUS 1 Is- tan dxom Jt r^cse fan< lions tnr nigh 
\Mtido\ s n t ^orrcsnonJ 1 h<. w >o is u>mi o iem o lit ^ -l rJOt \aes 
to th.. ,\\ i n kfj ^ii ie la^wu dpflu cJ illow n H c<,h 'UhoriMt ti-^rs to 
]o & m t< > ti e >\ st( i ui J pr< kumg scrmmc n torn 1 iu >r 

Ihc \ M> cai pstlorm *. nt or motx. of t folio % ma main usk^. if '■oi' ah 
the UTS 185; 

* Configure the system 1 00. 

♦ Create and run queries and reports on network acti vity and resource 
consumption. 
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* Register and license the system 1 00, 

C. Data Distillation 

{ oun. 1 lilus.raU's t ic uaud shildtior pro.c^ pet? Hired ^\ the swem 
<if Ti\.-i c 1 I he da!' oistil atson ac^reeates and ton elate .mormatjon 1 rori 
5 mar.} diUercrt ivtv ork Jcv ccj t> > ct mpi ^ data usetui m billing a id ne£v.< rk 
accounting. 

First, the ISMs 210 gather data from their corresponding network 
device \'ote lint Pn borne I'-AK <e l. p'pL, I^KM seal-t no poUy-oased 
"Vtcri'i on r jtejatiot " 1 S ^en v m "x, done I t! . duU is f hen iei i i the 

! 0 p ithere r s J "0 1 he 2a.hcRi^ 220 pcrroi m iU^ t n landmen to Ct >rrp(ele the 

cl ltd i om tK i^M > : 1 0 I he iciit? ai e provided m the C fc\I PO 1 he CPM 
1 "0 perit lit) data meraes 2 7 0 to iemos e t eauuasnt data f he merged d iu i , 
then opt onalh ^ored n the central datatu^e 1 7^ t s a billing itt otd 27 ^ <n ^ 
it l» reah, t i us t^.ttnJ sWvm V>k bi'ln*; tecora iriorrnuion cat 

15 ai^e*. cd fi< m e^cn, I appl'cat or 1 'hn u.'i ti c application .n^rf^c 2"!' v.a a 

can E^ecjd lish 1 i ten r><2 and aggregation a m m datie hirtertcms t in K 
done at any stage in the system 100, 

D, Data Enhancement 

As mentioned above, the gatherers 220 provide data enhancement 
20 features to complete information received from the ISMs 210. The following 
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describes some example data enhancement techniques used in some 
embodiments ot the invention. 

F sjuxe * til u states at cample oi dau enhancement Dai:, enhancement 
compr, "e a "Lmra oi field enhancement-, V Held enriareemuu ■Mfrufie^ now 
S die data obtained hom fit- nig^tr of the una-H-cnur ptoot.auto is pressed 

beti >u- it s placed m a -m>?k. field m r\o eentrai database 1 ~5 i he data ca 1 he 
places m the fiJi d; eah, ot new information ma^ oe dv-dfM to the teeoid rn 
aophififc ^ Sjrcnroauis ISM -function J i tlie example be.rm, the Timet <>n n> 
"reseh e the IP iddivss to a ho FQ^N J h teld enhmeemerus may im nK e one 
10 or 'TUih r*e ,'c> I nore is no !tmu t j tat r un^ii' < " sk n a t jde 

1 nitiiketi v.*. t T he dita sta is wsth f ^ d- obtained iRin an js^ciironoiis 

iSM T tO Ihw Held? in die DR -U0 are then enhanced uans; the ftdo 
enhancement- The enhanced fields refill in tht DR 'CO 

\ visual represenlti'ton oi an enhancement c-m he presented Jo the NSP 
15 I he enh ifKemem ma\ include an t irieran oi T^M^ at irt mi vli wit'i in AfS\t 

passing throvgh PTS^i- <.nd fermir ,at' ? m the H M 7') t wng tins \>ev ot the 
v \ten \d ) die M^P need not be ^ho^ n tl e acre^l t>ov t dau ime the tlf w 
ma> be onumiAxl ktet m ordu to achieve better performance THo is mote of a 
graphic i\ loasc ] \ ich of hov, die erinucemcir i c acmcwd m s*ept- (PiSVfs t an 
20 terminate more i^a i c ne iow ana inmate more th m oi r flo^ ) 

V \i aa! rep esenunion >>♦ a field e i5 a'xenvnt sho'\i the per-tieid flow 
..f data aire aiion [ hi , process ends tn tat. CLM 1 70 «r in a t'TSM 1 ne NM* 
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supplies ^formation telling the system 100 how to reach each of the terminating 
fields (in the CEM 170 or the PISM) starting off from the initiating fields 
(FiSM or AI SM), Each step of enhancement defines cross correlation with some 
SISIvl function. 

5 I C n 4\ u.usKn^ .arious held c^rmrat^nts {4. " though 4401 \ 

heid uihanLuncnt men des apphi ift ?i <> >r more nrwu' ns to a fiJd beion- 
storm., tie tie! 1 in J cpecr'tcd field m the (.crura) iaubasf 1~" 

Ore «-tep 1 ie!d Enhancement ■+ 1 1 Th„ m\ a! souicc da'a Iron the 
is^nw-ronnu-. iSM i phctd iirecth n ,i held in the centre, databa^ I7> 
10 £ \ampk *>ie r ;ld s. nhancemtnt to, tic bourse IE' tteld 

o-Up 1 k d f nhuncetnem 520 The initial source data from tin, 
a vncmcnous l^M i<- usou to obtain new i-d uonai dau horn 1 ^ ndi, >>»«», * 
network deuce aad the nen dat<> is placed >n . Odd in the central d^uruse 1 "5 
h vamp't the fi.ld Dih mcenieni ioi the bourse Host held 
? 5 Trn^-s t-p n i. n. .n'nt 4 >0 1 nt initial source data tror the 

. s\ mru onous S\f i- t sed to obtain additional diti tiom a s\ nchmnous InM 
The le-uit s used tt obtain unc data iron, dimmer -SM ana i'te .c ik j 1 u.e i 
m a field ai the centni database PS 

Tne lolloAiiu llustra't's an i.-\,mtp!e dan enhancement SuppoSw the 
20 d ta o 1 dine 1 in in . po\v smer 1'H uontdirs die sours IP addrec- d anven 

i^ssmr -m ri as 1^ 20 - 1 "2 2, but no* the complete don win additrs of the ho 4 ' 
con nutu f-s 1 ulK Ot^k3be<. Domain \amcl =uch as vv\ w com The 
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name of the host can be obtained by another network device ■• the Domain Name 
System iDNb 102"! server. The DNS server 102 contain?; information that 
matches IP addresses of boat computers to their Fully Qualified Domain Names 
(FQDN'st. Through an enhancement procedure the information collected from 
5 the proxy server 101 can be supplemented by the information from the DNS 

102. Therefore, the name of the host is added to the data (the data record) 
collected from the proxy server 101. The process of adding new data to the data 
record from different network devices cart be repeated several limes until all 
required data is collected and the data record is placed in the central database 
10 175. 

Figure 4B illustrates another example data enhancement where an 
enhanced record 490 is created from an initial nettlow record 492. Fields in the 
enhanced record 490 are enhanced from the radius record 494, the QoS policy 
server record 496, the NMS DB record 498, and the LDAP record 499. 

15 Defmi nc Enh incernen' Procedures 

The following describes the process for defining enhancement 
procedures in some embodiments of the system. Typically defining an 
enhancement procedures for the system 100 includes d) defining enhancement 
procedures tor each asynchronous ISM and (2) configuring field enhancements 

20 for all fields in The central database 1 75 for which the NSP wants to collect data 
originating from an asynchronous ISM that triggers the corresponding 
enhancement, procedure. 
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n enhancement procedure can be defined as follows: 
Access ihc CbM 170 using the UIS ISO. 
Select the enhancement procedures list using the UIS 180. 
Define the name of the new enhancement procedure. 
Select a trigger for the new enhancement procedure. The trigger can 
crtrrespond to any asynchronous ISM ;n the system 100. 
Alternatively, the trigger can correspond to any asynchronous ISM 
in the system 1 00 that has not already been assigned to an 
enhancement procedure. 

Optionally . a description for (lie enhancement procedure can be 
provided. 

The new enhancement procedure can then be automatically 
populated with the existing fields in the central database 175. 
Optionally, the NSP can define the fields (which could then be 
propagated to the central database 175). Alternatively, based upon 
the tvpe of asynchronous ISM. a preset set of fields could be 
proposed to the NSP tor editing. What :s important is thai the NSP 
can define field procedures to enhance the data being put into the 
data records of the central database 175. 

The NSP can then define the field enhancements for every Held in 
the new enhancement procedure for which the NSP wants to collect 
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data from the ISM that is the trigger of the new enhancement 
procedure. 

Defining Field Enhancements 

Defnmg ? *k-\1 crniaicement unolve^ bpecitv.ng the sc. of rules used to 
5 ii J a datable f-eid hem the mtounaimn obtained f-om the trigger of the 

enhancement prcx (Jure 1 fa. NhP dc".ne.? field enhancement, tor each field in 
which N'SP want'; tu collect data horn the tngget li lo field enhancrmmts ate 
ae.mec, no data horn tht tngj.fi \ull he collected m the fidd- Foi c\ampk. 
supper th fkew ill a-,v!iL itonous LSV H( that ti aa^i.? an e\harejmetu 
10 pmceduic Mipposc the centi il database f • has the inform.: fields --ouree ,p, 

s»utet' host, ie-tmation IP destination host, user name, a?ul hyt-b, <:viu\ 
catc'tims. anc URL the KSP ^ara^ to collect ;>e:>Mi n dita tot each fie.d 
except the I 'RL from the firev. di T^M 1 "0, which triggers the enhareemem 
pni'-edait. die N'^P dt fines a field enhancement t M each field with trc 
1 5 exception of the URL, 

in some embodiments, the field enhancements are part of the 
enhancement pn -ceciu e and the NSP can c-ni} define and modify tnem whu; the 
enhancement proeeuure is not enabled 

The Odd enha.teemeiits v. an be defined in a field enhancement 
20 coifhra ation maiog box i he field enhinccment vonfigaruu.sii dial, -g b-'\ can 

have two pan^s The first dsapiass the name of the enhancement piocedtsre, the 
name of us trigger, and the name and dat? type ni the field fur .\hkh tin. KSP ii 
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defining trie enhancement The second k dsnamjc ard interact \c lu 
u nlent «.haniec depending on the NSPV input Wh-i iisi Jjspli»>ed it iu* tw«» 
Uwie buttons Fnc «nd v. umimu. ami , j iKt next tw them lhc content ot tnc lis* 
depends on the button depressed. 
5 When Hnd is depressed. Uic list contains at! output fields whose data 

type matches the data type of the field for which the hi SP if defining the field 
enhancement, for example, if the field's data type is IP Address, ihe H:;1 
contains all fields that are of the same type, .such as source IP and destination IP 
that the A1SM supplies. The- fields in the itsi can come from wo sources: (1) the 
1 0 source data which the gatherer receives from the trigger and (2) the result 

obtained by applying a synchronous ISM function a* it preceding step in the 
field enhancement. The following notation is used for the fields. 

Output FleldName for the output of a field origination from the trigger 

SlsywnejuncihmNametlnvutArgument). Output field for the output of a 
I 5 field that is. the result of j : pplyitu> a function 

S'SXame.. Ouipuirieid for the output oi a field that is the result of 
applying a function as the final step of a field enhancement 

The following examples are presented. 

Source IP is the field provided by the trigger of the enhancement 
20 procedure thai contains the IP address of the source host. 

DNS ..Host Name and DNS.NametSouree IP). Host name are the names 
of a field originating from the resolved function Name of a network device 
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called DNS that resol ves the IP address to a domain address. The input 
argument of the function is the field provided by the trigger of the enhancement 
procedure, called source IP If contains the IP address of the source host. The 
function returns The output field called Host Name that comains the domain 
5 address ot the source host. The notation DNS..i-3ost Name is used when the 

field is the result of applying the function as the final step of a Held 
enhancement. 'Hie notation is DNS/Name(Source IP}.HostName is used when 
the field is used as ibe input to another function. 

In the user interface, if End is unavailable, none of the output fields 
] 0 matches the data type of the field. 

When Continue is depressed, the list contains all applicable functions of 
the available synchronous network device configured in the system 100. If the 
preceding output does not match the inpur to a function, it cannot be applied and 
does not appear on the list. 
1 5 'T he following notation is used for the functions: 

S!SNameJhmciionNamc(inpiilFietdlsamc Input Fk'UDaiaType) 
~* {OutpiitFicldName:OutpuiFichiDaiaType) 

When the function has multiple input and/or output arguments, the 
notation reflects this. The arguments ate separated by commas. 
20 The following example shows a field enhancement. 

DNS. Address* Host NamerStrmg) -> OP AddreasJP Address) 
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Where DNS is the name, of the synclwonous ISM (or network device) as 

it appears in the system configuration. 

Address is the name of the function, 

(Host NameiString) is the input to the function - host FQDN of data type 

5 String 

(IP Address:!? Address) is the output - IP address of data type IP 
Address 

The NSP can define the field enhancement by choosing items from the 
list. The list contains the option <none> when the End button is depressed. 

10 Choosing this option has the same effect as not defining a field enhancement: no 

data from the trigger will be stored in the field in the central database 175. 

At your request, here is one paragraph describing the aigomhm(s) 
transforming the user representation of" an Enhancement Procedure to an actual 
Computation Flow performed by the system. The source code accompanying 

1 5 this actually implements most of this. Of course, dun code relies on the rest of 

the software dots of other code), that may be required to completely understand 
it. 

field En hanceme nt Conp»ntior 
In sonic embo<'uiR' its an enhancement piocedute (LP' 1 amines a Pow ol 
20 data u^.i h i > sh. swum WO. ongtmiKs: from an A'SM trut ie tc- a-- a 

tiifrtr and tctmitutirR at ths - auubase table, oi a i'l?»M ( P'P 1 - ISM - h « th. 
nchd\jor of tie database ot '-emu a»si&.'ned input keys m nun h the ^ame w\ 
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i lit heir,' msuijaple lepkic.Hc L g't in ti^ swan arur u tu* Ken depiosed) 
known as ii* I a. get oi lik, I P .n J P is repie»ei red t > inc user aa a eoilecuor> 
o Held 1 nbancciwii^ (l Esi, I ach Fh identifies v\na is .vsln tja' h imbt 10 
obtair a <oi i asi.oideifned) fa that Hdd (cities d itrh.^e field or 

5 input K\ u riSM; ,wiu< \alin. , origin,!, m« rrem me 1 ruget A.SM possibK, 

utih/ir g iuaau no oi SISMt a\a:lahk m .he s>si<~m 1" ioN^P aefne; e\crs H 
uubpcnicnrh > i oiierH,^ and eompleidv 1cfhu> whct\ 4 aie pkeed in the 
defined field. 

t _oo Jdst to the an^ v. dt.sv pt on . J th mi^'j tat. on to t> e isei oi an 
10 t 11 tie L1 ^ u 1 00 t j, i k_ ( 1 Ml "oi i ,-npue. wha 1 > c kd i Lu ucu non 
T lov v i u > i>k -vUdl o*vra'ion i i> 'ruaiuns ma p i«rr«. lei tra< < re 

ii Ntrucuu to u . y Uheier > o ad ie- u re dts tt.d NSP resalt u dvtuxu n the 
r t' } 1 at. Oi n put J ui: i- h^i , the daaileu inflections i .qur-\ n idue^ *. - 

rov, > ii! at oi has mg &n~ onui n nu in. n t Timf J ( ^S\Ft 1 1 out 
IS a-ather* mu^-V" mvuIk aihm e icats tn mdira if sul s ftora nMi-an >ns n 

tinUn ns <>t S1SM v i i s*xcdi< irput pain a on 1 1 ais s.. tntr^' < r other 
uathtrers t is uqimed i and s em»* n,_ um ^ed tit ds abng thi -anu { uh 

entua'i -aorm,.' U t user ifi^u cd ren its i i L ne j<-er-ci>ii{ „ t red fields if t u 
opttm zed L hion Tie oittm \7 uionx lpplied art 
20 • 1 iii tcrinmsmaj da 1 i xtntu my t tin^o*^ ir "y s\ster 
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« Do not compute the same function on the same input more thai) 
iukc In other cn.bnch nems, this opnmbMJ< n tn ic thmra to 
ahow tn! shcnng of m,ermt*dian v tines of field enhancements. 
• Pu -om .oval enhaucen cm* rtefore »otnj~ o-i V ~ remote gatherc 
5 * \ppb a ^< 'unction .o .la'^femth: aion£ communication Isnl 

d id tiavenc tic mmnrui cost ri a comput«in«> £ <v> tvqirred t « 
achieve correct resul ts. 
Ih.s of optimizations con be perfoi tied in somt t-mbodirrents using 
fee cod. 1 ir Appendix <\ Ihat i->. the tr-n-h raia'ion ( 'joni hP to Coirputafion 
10 n«: ,\ o s «,p , Hoa is .tLiiiPwd hi ^oi.rhng to^ttvi e e\cr a^riurr- 

data transformations one after the other. These are described in the code module 
attached. 

Note: \) Within the code, EP, Rule. Computation Flow are used in. some 
cases to refer to the same objects. 2) The eleven transformations that arc applied 
5 to the user representation of the EP, after being stored in a database structure, 

are outlined beginning at line 124 of the attached source module 
" FlowMana.ger.java" . 

E. Record Merges 

Figure " illustrates an example recotd me T gc Reeotd rnejsrnj; lemoves 
0 cupiKau r.c-orJi fiotu ; ,e cential database l 7 5 

T ne ioI ovant, Cvatr.p.e shows how meiy<.-> v,<>il> ( .nd illu?ttates the nctd 
It i rnerypig duplicate reeorcs. Suppose the sWem 100 s using Uw 
36 
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asynchronous I'SMs 1 10 and 130, All outbound network traffic going through 
the- proxy server 101 =s routed through the firewall 103. T"he firewall 103 records 
the proxy .server 101 as die source of ail sessions passing through the proxy 
server 301, although they originate from different workstation? on the network. 
5 At the same time, the pioxy server 101 records the destination of ail sessions as 

the firewall 103. although their actual destinations are {he different Internet 
sites. 

Therefore, all sessions are logged twice by (he system 100 and the 
records are skewed. The data from the firewall 103 indicates the destination of a 

1 0 given session, but not the source (see data record 520). while the data from the 
proxy server 1.01 records the source, but not the destination < see data record 
510). Defining a merge eliminates the duplication of records. 

A merge can be defined instructing the C£M I "0 to store the destination 
data obtained from the firewall 1 03 and the source data from the proxy server 

15 101 in the central database 1 75. The merge will also eliminate the problem of 

skewed data by storing the correct source and destination of the session in the 
central database ] 75. Both network devices provide information on the URL. 
The latter can be used to identify the fact that the two seemingly independent 
records (510 and 520 > are actually two logs of the same session. 

20 Two enhancement procedures are defined for the example of Figure 5. 

The trigger of the first, designated Flow One, is the Proxy Server Asynchronous 
Information Source Module. The trigger of the second, Flow Two, is the 
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Firewall Asynchronous Information Source Module. The records from Flow 
One and Flow Two are records of the same session. They boih have the same 
value for the URL field. Based on this value, the CEM 170 identifies the two 
records arc double logs of the same session. It merges the two data records 
5 taking the Source IP value from Fiow One and the Destination IP from Flow 

Two as the values to be stored in the central database 175. 

Def ining Merges 

The following describes defmmg merges. A merge is a set of rules that 
specify how duplicate records from multiple enhancement procedures must be 
1 0 identified and combined before being stored in the central database 1 75. The 
NSP can merge the records from two or more enhancement procedures. To 
define a merge, the NSP identifies the following information. 

* The enhancement procedures included in the merge. 

• How to identify duplicate records ( which fields of the records must 
! 5 match). 

♦ Flow to combine the records; that is, for each field, which val ue 
(from which enhancement procedure) must be stored in the central 
database 175. (Optional) 

If the NSP does not specify how records must be combined, the records 
20 are merged as follows: 

• When the values in all but one of the fields are null, the non-null 
value is stored. 
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• When the fields contain non-null values, the value oi ihc first record 
received ('chronologically! is stored. 

P. Additi ona l Embodiments 

The following describes additional embodiments of the invention. 
5 la Bonn- embodiments, the user interface used by an MSP to configure 

the system 100 can be presented as a graphical representation of the data 
enhancement process. Ever,- step in the enhancement can be shown as a block 
joined to another block for icon or some graphical representation}. The 
properties of a block define the operations within the block in some 
10 embodiment, the em ire data enhancement process from network devices to the 

central database 175 can be shown by linked graphics where the properties of;; 
graphic are the properties, of the enhancement at that stage. 

In some embodiments, multiple CEMs 17o and/or central databases 175 
can be used as data sources .'back ends) for datamart or other databases or 
3.5 applications i e.g., customer care and billing systems). 

lis some embodiments, the types of databases used are no; necessarily 
relational. Object databases or other databases can be used. 

In some embodiments, other platforms are used. Although the above 
description of the system 100 has been IP network focussed with Unix or 
20 Windows NT systems .supporting ihe elements, other networks (non-IP 

networks) and computer platforms can be used. What is important is that some 
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>r <> ' r>-o^w»c <nid *toi ir* capah Uh is avaoab.e at the f.therers, tlv CLM >. 
the databases, ai d the user tnu-naee serwt 

[ i some embodiment the statherer^ and u*hej elements .^"the v stem 
xUU. c^n t»t- ltmoteo) ct rifLurtd whtie ir othet e nbodh icnu Mims c f the 
5 ek ibj! need to K l rt n figure 1 d >i eeth 1" oi c\,s upte. a gatheier may not be 

r<-mntf.h loi tigu tabic m wfuch wta< . tiu NSP rvi-tf mlerfaee d,!cci\ with the 
coinputtr ruining the githcrcr. 

Ir othet e nbodirnenls. the »encra: ideas described heiu:i can bo applied 
to > 'the! distributed datr erucnccmcm proh em.' fox example some 
10 embodiments of the tmenooa could >x um.-J to pc four data source extruumn 
anddato -Hep nation *Vh disawt'enonsii.e applications lht ^arheicrs would 
mterta.e wuh I^Ms th u are designed to extiact iau u^ro databases Un <>tner 
data sources ) Lie aatherets would perform ill term:: and aggiegauon deporsdrnj, 
upon the ne.ds of the datamarl \ m snd\ an cnibodm.cm, the e.-i.ir/il latalvse -md 
1 5 *-EM eout i be rep^ctd with'Ubed \silh a dayman) The d sta enhancement 

^o-ald + hen oe done bJoie storing rhc imormauori m the datanun 

F ju>' d illustrated a systun <**U vdute multi^L ^vst:ms l f, 0 ate tmr.ed 
together 1 hio ■>> stem eoiOd be an ISP? pomt of presence accumtint <-\ stem 
I he s>«tcm ana the ostein clO can stc-jc detailed network ai. counting 
20 tilonruuen n their local dt tailed accounting databases 'lias information can 

then be aggregated and .sent osertlu more opomvvs Song dis'aru-c tnik > to th: 
billing enable vi tre <-v3te n <o0 C ustomct sen tee lmormation can ttiF be 
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accessed at the detailed accounting database, but the aggregated information 
may be ail that is needed to create the bills. 

G. Conclusions 

A network aeujummg and billing s\ neni a A tn.-ibod has been 
5 desenned hi some e^bodimeMv t-iC s\Mem can .iceo-p am network -eUued 

tmonnanon iorroes such <w trUi'ie 3tat1sr1-.fi p~ouded bv routers and svuidung 
hubs a\ we ! i as applie.iti.m snier access iogs These aie accumulated in a 
centnd database tor cieat-ne auditing, accounting and b.ihng reports' Because of 
the dist- tuuea aichitectiue. filteimj: and e:iUa-Txem?ms. '.he ^wem efficiently 
10 a:io actuate* e jlkas mt neuvoiK a-age mfernuit-oM f ot smt i^- mi .1 f< <t -n ih « 

is UicLii for bil.m^ and aecoimmtjL 
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Appendix A - FlowManager 
Example 
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CLAIMS 

What is claimed is: 

I . A system for tracking network session information, the system 
comprising: 

5 an information source module having a source information input and a 

standardized information output, a source information corresponds to 
network usage information, a standardized information corresponds 
to the network usage information transformed into a standard format: 
a first program having at least a first standardized information input and 

1 0 an enhanced data output, a first standardized information input 

corresponding to the standardized information, an enhanced data 
corresponding to the standardized data after at least a partial 
transformation, the at least partial transformation being defined 
according to a data record format; 

} 5 a second program having at least a first enhanced data input and a data 

record output, the first enhanced data corresponding to the enhanced 
data, a data record corresponding to the first enhanced data, the data 
record being formatted according to the data record format; 
a. database storma the data record; and 

20 wherein the second program merges duplicate data records that represent 

the same network usage information. 
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2 The system of claim i wherein the at least partial transformation 
is defined from a data enhancement procedure, and wherein the data record 
format includes a plurality officios and wherein the data enhancement 
5 procedure defines how the standardized information is to be transformed into 

the plurality of fields of the data record format. 

3 . The system of claim 2 wherein the data enhancement procedure 
includes at least a fieid enhancement wherein the field enhancement defines a 
source for a predetermined field in the plurality of fields. 
1 0 4 The system of claim 2 wherein the data enhancement procedure 

includes at least a field enhancement wherein the field enhancement defines a 
function to be applied to at least a portion of the standardized data. 

5. The system of claim 2 wherein the data enhancement procedure 
defines a plurality of field enhancements, wherein each fieid enhancement 
1 5 defines network usage information to be stored in the plurality of fields 

6 T he system of claim 5 wherein at least a first field enhancement 
corresponds to an information source module that performs aggregation on at 
least a portion of the network usage information to be stored in at least a first 
field in the plurality of fields. 
20 7. The system of claim ft wherein the aggregation occurs by 

aggregating packet flow information, the packet How information corresponding 
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t< a t diu ot pad <,t w trc uuh puA^t m T he 'gj , jj'tii r ),k t, la 
ame IP sour c iaarvs 1 - a^."tn^tion odircs^ c ni p<>ii > iii>i fla urn 

8 The ^ rem of ^ am - v*h^'i < ka> <. 4 si hcL eiiiaii^ntiv 
i on^sp i T d^ if i -t- f t ' fnior" < jon L o i<_e moi u'es ih* peri »ms fi tei m and 
5 i^gtckat'on o" af ist a pottior M me nav crk us rkraut or t j ^ /oud 

n at is^i i*Mr m me p srihv* o f rb<.. s 

? I s\ sum c U mi " v he c r at k 'st a 1 'it iiei i tnisar cement 
vorresporKU to a '■a ci i A>muuon sou-ce modu tha p<Horm> r-eremg 
fiiterrj ji d aaaresratior on af lean i action oi the «<■ t > ork bs ju> irioimn on 
10 oiifMinin itki,' D s neH the p iraim Oi ithls 

R I he \ >tui > vLim > <- rer-* u a Last a f i ->t i uJi mvcmcrt 
(.oi espo ids t< ic oi mferrnauon t nuru n oouiov t> it ni*i + oti ^ est' * 
noftticium i ■* pm% tsinnim: actuation 

1 , Ire s- xtem ot dajtrt 2 t rtner com^rwrii, m^oi d i , ornnlioi 
15 sou. cen id - ■'C ^<> J n'omi 'lion ) jr.*. m idu't. ^nisa^wunL h h t 

tniorm 4 « n np-ut and « f-u no -^aniatcn td mlon i Jtio^ output ^ u>nc 
*oni a ,o i ^ rrt< >\ mis to ? --e^ond ictn il im< r rn'ti r a s*co*u 
tand in ^ d j.i )rm u <. n toitvspurk s U Vt- <n_r>nd network n i<> -nitfon 
fansk rnk'c i it< a ~a --dani i ,rma.t a id n herein the dctr enh n^emert 
20 proi>cuur" 'n^. ide a ir + Jv. Jtntior oi *t ca"f a s r s fv'u m f i^ pluia h <i 

CtJi i-i^m^. in Ik unu i ii '<.a hitotm on ~ ( id ct lea^t l >c^<. ni ot Titian 
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of a second field in the plurality of fields being from the second standardized 
information. 

1 2. The system of 1 1 further comprising a first information source 
wa i quality > sen ke iruonruuo r i ->< u>i_o i'a»tfi'»i 1 - mil .r j'io. sourt.e 
5 modub s t\Ls the t*.i .ork u me jrfcrmat < n tr">m tit r t i^io'-m-ition 

m urct- ^ 1 w-e-e, i the aonu im< muu<> i source 'u *cu v .iun« t 1 c -vc^a 
tKTvork i toiria.on from the qualit <t er n_e inionmtto m trc and 
.\ntt< in T hc fin t definmoi wfi»L •> thtt a source U* addtc •> muted >w me List 
mtorn jiuon -o^rce ^ uli p t nto t\ isr^l field aid Hlvtein *he second 
10 ieLniu i u i res i ii p ii k b thv D'^ c .t, Nuil]leiK',rotji^;umu 

tic Id. 

H The s\ v.m daim 1 '\haur the stcoru pr >gr.w max rfge <h 
rrst projrwn and the miorma ion soutc^ module 

.4 The s.st^^T o. i nm I sherur the >e<.on t onuw ciuscs the 
35 irtaicx id lo K m<_i m *1 edaub?sc 

i fue s m uo I u ii ' \here.r the inVrm^ on c^. ncua'e s 
a>n' gt^vi 1 1 - tu*<. tiw ru^o's isaee miorrut i r r tin an -dekirnne 1 
network device. 

1 6. The system of claim 1 wherein the at least partial transformation 
20 includes poiicy-based data aggregation which defines how network usage data 
should be aggregated. 
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1 7. The system of claim J wherein the network usage information 
includes iP session data. 

1 8. The system of claim i wherein the data format includes a 
plurality of fields including a source IP field, a destination fP field, a source 

5 host field, a destination host field, a service type field, a date and time field, a 

duration field, a total number of bytes field, and a counter field. 

1 9. The system of claim 1 further comprising a customer care and 
billing system coupled to the database, the customer care and billing system for 
accessing the database to generate a bill from the data record. 

10 20. A network usage accounting system comprising 

an in formation source module coupled to receive network information 

from: a network device; 
a gatherer coupled lo receive the network information source module, 
the gatherer for performing data enhancements on the network 
S 5 information to create a plurality of data records: 

:s central database storing the plurality of data records: and 
a central event manager coupled to receive the plurality of data records, 
the central event manager merging duplicate records in the plurality 
of data records, the duplicate records representing the same network 
20 usage information. 

21 . The system of claim 20 wherein the inlormatkm source module 
is configured to receive netwotk information from a network device chosen 
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!"rom -he aroup of network devices consisting of a proxy server, a domain name 
service server, a firewall, a RADIUS server, and a router. 

22 . The system of claim 20 wherein the gatherer performs filtering 
and aggregation on the network information. 
5 23 . The system of claim 20 wherein the plurality of data records 

have a predefined data format comprising a plurality of fields, and wherein the 
data enhancements includes at least a first data field enhancement to enhance 
the network information to fill in the first data field. 

24. The system of claim 23 wherein the first data field corresponds 
10 to a source IP address field and wherein the data enhancement includes 

extracting a source IP address value from she network information. 

25 The system of claim 23 wherein the first data field corresponds 
to a domain name field and wherein the data enhancement includes requesting a 
domain name front a domain name service server. 
IS 26. A method of gathering and aggregating network usage 

information from a set of network devices, the system using at least a first 
program and a second program coupled in communications, the method 
comprising: 

accessing netwotK ctrnmur.icHjotis u^.ge information 
20 fi ten « a tic a^rcssur.wg ilu network communications uiiCc ruorrnatior 

using the first program; 
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t > jEiif icrtinu . pair.dif\ «> data rounds -toa. ne fihertM ana aggregated 
network communications d.?age information, the plurahtv 01 data 
records corrctoonairg to ne.w< usage <j\ ± plurality ' i users. 
^TOf mg *"e pi iralirv <>t data tee ords .aid 
5 niorg'n? duplicate re:ercs tr. the p.urai-ij oi data tecord - 

27 rhe method of claim > v. herein mmpiet.ne Lie nluratm of 
jecsnds ii. ( hides iing user recount i trorrtation 

2i> ""he method of claim 2C> wherein completing the pluraim of 
recotds, includes for each dau iccorc determmma; a corresponding source IP 
10 auures . a corrcsronamr: domain r^ane, a corresponding rvpe oi service u.s<,U. 

ana ^ «,.jm.s:>onainu anoint of time used. 

2° Trie method of claim 1.0 whmin the s> stem include ^ third 
program eoup.ed in communication i with ai .east the jtvonei piogiam ai:d 
wherein eomtMeam: tnv plura dy ot records ^neludc" aDcesrme; + ne third program 
15 lo dc-ftvmirv u-twn 1 au o.rt infarction a no in.ludir>{.' the r.r nuik .n.coi:nf 

lotonrntior n it lc\i&:a first reeoU in :Ju phir.dtt\ ot -ecord 

3C I he method of claim 2r- waerem rncrmng the djuhcau ucords 
includes _o nn'.nns.' a plurality of fields ir the data reciiiji to j deni i fj data 
ieco:d< corresponding to the same network sc< s;on ar.d merging the 
20 co ires no riding records. 

1 The 'nc*'iod o- cla.m 2o therein merging iK duphcafe reoor-N 
.■icmdcs ai.tomitical.v deLtmt. l duplicate record 
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52. The method ofciaim 26 further comprising using the second 

program to automatically update the filtering and aggregation performed by the 
first program. 

33. A network usage tracking system comprising: 
5 means for accessing network communications usage information; 

means for tittering and aggregating the network communications usage 

information using the first program; 
means for completing a plurality of data records from the filtered and 
aggregated network communications usage information, the plurality 
1 0 of data records corresponding 10 network usage by a plurality of 

users; 

means for storing the plurality of data records; and 

means for merging duplicate records in the plurality of data records. 

54. The network usage tracking system of claim 54 wherein the 
1 5 means for completing the plurality of data records includes one or more 

networked computers running one or more programs. 

55. The network usage tracking system of claim 54 wherein the 
means for storing the plurality of data records includes a relational database. 

56. The network usage tracking system of claim 34 wherein the 
28 means for storing the plurality of data records includes an object database. 

57. A system for accounting for network usage comprising: 
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\ <>iiiT . v . ^ ^ tVs ers u>up ca tr rcxisc i.awork i>d.ic mtormatton. 
jacii gathcrei for performing data eiUta-n. emenis on the network 
niormaaon 'o create a phna!tt\ ot d3ta toconis. an.t 
cenral e\em mana^i < eupied t.< receive the pmralr\ of data record 
5 the centra a«i xaiia.'cr mcrpmg jur>h<\><e leeords m rre p sirdlti\ 

d J'if£> set ord , jhe uu jitcae rvcorus rep-e^ntirr the >ame hcnsotk 
usage information. 
3$ The s> stem of claim 3^ further comprising a rustoroei t-ar^ and 
hl'.'u a]- pit n. n it i receiving the nuratitv -M da a r^circts Mia gjicnerattru' 
H) bills. 
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